Seeking the Truth from Mobile Evidence

1. Defining Cell Phone Forensics & Standards 2. Evidence Contamination and Faraday Methods 3. The Legal Process Part 1 4. The Legal Process Part 2 5. The Cellular Network 6. Subscriber Identity Module 7. Device Identification 8. Triaging Mobile Evidence 9. The Logical Exam 10. Troubleshooting Logical Exams 11. Manual Exams 12. Report Writing 13. Physical Acquisitions 14. Physical Memory & Encoding 15. Date and Time Stamps 16. Manual Decoding MMS 17. Decoding Application Data 18. Advanced Validation 19. Android user enabled security 20. Non-destructive hardware and software solutions 21. Phone disassembly and water damaged phones 22. JTAG (Joint Test Action Group) 23. JTAG specialized equipment 24. RIFF Box Overview 25. Z3X (Easy JTAG) Box 26. Thermal chip removal 27. Non-thermal chip removal 28. BGA cleaning 29. Creating an image 30. eMMC Reading & In-System-Programming

John Bair is currently employed as a detective with the Tacoma Police Department. He has been commissioned as a law enforcement officer since May 1989. During his assignment in the homicide unit he began specializing in Cell Phone Forensics.

In 2006 John created the current forensic lab that focuses on mobile evidence related to violent crimes. His case experience shortly thereafter gained the attention of Mobile Forensics Incorporated (MFI) where he was hired and spent several years serving as a contract instructor. MFI soon merged with AccessData to become the only training vendor for their mobile forensics core. This relationship fostered direct contact with engineers who assist in criminal cases which need anomalies and exploits addressed within their forensics products.

July 2013 he was hired as a contract instructor by Fox Valley Technical College to assist in training for the Department Of Justice - Amber Alert Program. His expertize with mobile forensics is being utilized to structure a digital evidence module for investigators responding to scenes where children had been abducted. The program promotes how to prevent mobile evidence contamination and how to triage live devices under exigent circumstances.

Within in Pierce County, he began a mobile forensics training program for Superior Court Prosecutors and Judicial Officers which is currently in its fourth year. The program stresses the technical origins of the warrant language, what to check for, validation of evidence and how to present this dynamic content in court.

In December 2013, Detective Bair gave a presentation to the University Of Washington Tacoma (UWT) Institute of Technology which provided an outline to merge digital solutions between the Tacoma Police Department and UWT. The relationship will focus on building a digital forensic lab that will be modeled after the Marshall University Forensic Science Center in West Virginia. The lab proposal also